Give each server only the access it needs
Create full-access keys for back-office tools and sending-only keys for your app, limited to the domains it sends from.
What you can do
Everything in api keys
- Full access or sending only
Full-access keys can call every endpoint. Sending-only keys can call POST /emails and POST /emails/batch and nothing else.
- Limited to domains
Limit a sending-only key to chosen domains. Sending from any other domain is refused.
- Shown once, stored as a hash
You see the full key once, when you create it. We keep only a hash of it.
- Rotate and revoke
Rotate creates a new key with the same settings. Revoking takes effect immediately.
- See each key's use
Each key's page shows when it was last used and its recent requests.
How it works
From first step to done
- 1Create a keyUnder API Keys in the console, or with POST /api-keys.
- 2Store it on your serverPut it in your server's environment. Never in a browser, mobile app or public repository.
- 3Send it as a Bearer tokenUse the Authorization header; keys start with irs_.
Good to know
- Prefix
- irs_
- Permissions
- Full access · Sending only
- API keys
- Free 5 · Pro 50 · Scale 100
- Domains per sending key
- Up to 100
Read more in the docs
Developer API
Ship email today
Start free with 3,000 emails a month. Upgrade only when you need more.
- 3,000 emails a month free
- No credit card needed
- Upgrade anytime
Get started in 3 steps
- 1Create your free accountGet an API key in seconds.
- 2Verify a sending domainAdd the DNS records we show you.
- 3Send with one requestcURL, Node.js, Python: plain HTTP.